Pre-auditThree days of senior audit time for $1,500, credited in full toward your Zealynx audit.3 audit days, credited toward your auditSee how →
L-08·audit-finding

Readiness views omit a blacklisted market from mandatory payment parties

Fixednfterc-1155marketplace
TL;DR

Readiness views omit a blacklisted market from mandatory payment parties. Final disposition: Fixed.

Severity
LOW
Method
MManual review
CAT.

Tracker: issue #34 · Status: Fixed · Verified at: audit-v3-rereview-handoff

02Section · Affected files

Affected files

src/PlakxioSettlement.sol#L988-L1015 src/PlakxioSettlement.sol#L1130-L1160 src/PlakxioSpecialMarket.sol#L371-L385 src/PlakxioSpecialMarket.sol#L404-L429

03Section · Description

Description

settlementBlocked() checks the buyer, seller, and fee-bearing treasury. purchaseBlocked() checks the buyer, holder, and commission-bearing treasury. Neither checks whether the quote token restricts the market contract itself.

The market is a mandatory payment party: receiveWithAuthorization() sends quote tokens to address(this), and the subsequent payouts originate from that address. If the quote token blacklists the market, every positive trade reverts even though the corresponding readiness view returns (false, address(0)).

Controlled tests first completed both trade types with clean accounts. After blacklisting only the relevant market, both readiness views still reported unblocked and the same signed trades reverted with Blacklisted(market). All token and badge state rolled back atomically. The consequence is false availability, wasted transaction gas, and slower diagnosis; creating the condition requires the external quote token's privileged blacklister.

04Section · Recommendations

Recommendations

After the existing party checks, make both readiness views test the market address:

solidity
if (quoteBlacklisted(address(this))) return (true, address(this));

Appending this check preserves the current blockedBy precedence while making the view account for every mandatory transfer participant.

05Section · Remediation

Remediation

Fixed. The readiness views report the market's own blacklisting — quoteBlacklisted(address(this)) is checked in both — so a blacklisted market is no longer omitted from the mandatory payment parties.

06Section · Verification provenance

Verification provenance

Final disposition: Fixed. Verified at audit-v3-rereview-handoff, commit f020448976eb7c4895e1626ef3228876cff2b7d2. This earlier remediation disposition is carried forward from the prior re-review, not independently re-verified in the generation-d pass. The report-wide scope and evidence limitations remain applicable; see the final report overview.

Status
Fixed
L-08